Vtiger CRM EUVD-2026-42054

Exploitation requires an authenticated Vtiger CRM administrator account (CVSS PR:H) with access to the admin module's ModuleManager import feature, and the ability to submit a crafted ZIP archive containing a syntactically valid manifest.xml plus one or more executable .php files. The deployment must serve the extracted modules/ directory under the web root with PHP execution enabled (the standard Apache + PHP configuration described in the advisory), so that the dropped file is reachable and interpreted over HTTP. Limiting factors: the attacker must already hold administrator privileges, so this is not remotely exploitable by anonymous users; no user interaction is needed once admin access is held (UI:N); and the vulnerability affects Vtiger CRM through 8.4.0 in what appears to be its default configuration where module import is available to administrators.

The CVSS 4.0 base score is 8.6 with vector AV:N/AC:L/AT:N/PR:H/UI:N and high impact to confidentiality, integrity, and availability of the vulnerable system, meaning network-reachable, low-complexity, no user interaction, but requiring high privileges (administrator). The single most important limiting factor is PR:H: exploitation presupposes the attacker already holds Vtiger administrator rights, which sharply narrows the realistic threat to insiders, credential-theft/phishing outcomes, or chaining after another privilege-gaining bug. Publicly available exploit code raises the practical likelihood that a capable attacker who obtains admin access can turn it into durable server compromise. No EPSS score, KEV entry, or SSVC decision data was provided in the input, so probabilistic exploitation frequency cannot be quantified here - treat this as a high-impact, high-privilege post-authentication escalation rather than a mass-exploitable unauthenticated RCE. There is no signal conflict in the CVSS vector; the network attack vector combined with PR:H is consistent with an authenticated admin reaching an HTTP-exposed import feature.

An attacker who has obtained Vtiger administrator credentials - through phishing, reuse, or a prior compromise - logs in and uses the admin ModuleManager import feature to upload a ZIP archive containing a valid manifest.xml alongside a malicious PHP file. The import extracts the payload into the web-root modules/ directory, and the attacker then requests that PHP file directly over HTTP to obtain a persistent web shell that runs outside Vtiger's authentication and outlives the login session. Publicly available exploit code demonstrates this end to end.